CVE-2007-6638

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-01-04 · updated 2026-06-16
Weakness: CWE-264

Description

March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, passwords, device names, and IP addresses via a direct request for scripts/logfiles.tar.gz.

Affected products

March Networks 3204 Dvr: all versions

References

http://osvdb.org/39726
http://secunia.com/advisories/28211
http://www.milw0rm.com/papers/190
http://www.securityfocus.com/bid/27054
http://www.sybsecurity.com/advisors/SYBSEC-ADV14-March_Networks_DVR_3204_Logfile_Information_Disclosure
http://www.sybsecurity.com/pages/advisors/static/dvr3204_exp.txt
http://www.sybsecurity.com/resources/static/An_Insecurity_Overview_of_the_March_Networks_DVR-CCTV_3204.pdf
https://www.exploit-db.com/exploits/4797
http://osvdb.org/39726
http://secunia.com/advisories/28211
http://www.milw0rm.com/papers/190
http://www.securityfocus.com/bid/27054

Get alerted when CVE-2007-6638 or the next vulnerability affects your stack